Connecting a code source Getting started through GitHub Getting started through Amazon S3 Creating an environment Following the first scan

Getting started with code vulnerabilities

AWS Continuum scans your code sources for security vulnerabilities.

To start using AWS Continuum for code vulnerabilities, use a GitHub or Amazon S3 integration. If you don't have an integration, create one. Then create an environment that uses the integration.

By default, you can add up to 10 code repositories to an environment across all of its integrations. Integrations and environments are subject to additional quotas. For more information about quotas and requesting an increase, see Quotas for AWS Continuum.

Connecting a code source

If you already have an integration, continue to Creating an environment.

Otherwise, choose the procedure for your code source:

For GitHub, follow Getting started through GitHub.
For Amazon S3, follow Getting started through Amazon S3.

Getting started through GitHub

To scan code hosted in GitHub, connect a GitHub integration. Then create an environment that uses the integration.

Use a GitHub account that can install the GitHub app, or request approval from an organization owner.

To configure a GitHub integration, do the following:

Open the AWS Continuum console at https://console.aws.amazon.com/continuum/.
Under Code vulnerabilities, choose Integrations.
Choose Add integration.
For Source provider, select GitHub.
For Name, enter an integration name.
For GitHub account, select Personal account or Organization.
If you selected Organization, enter the GitHub organization name for Organization name.

To install the GitHub app and authorize the integration, continue in the same form:

If the GitHub app is not installed, choose Install GitHub app. Install the app in the account that you selected.
If GitHub requires organization approval, wait for an owner to approve the installation.
If you opened the GitHub installation tab, close it and return to the AWS Continuum console.
Choose Authorize with GitHub and create.
Complete authorization in the GitHub window.
Return to the AWS Continuum console.

If the console still shows Waiting for GitHub after you authorize, choose Cancel authorization. Start authorization again.

After you create the integration, the console opens Create environment. Continue to Creating an environment.

Getting started through Amazon S3

To scan code stored in Amazon S3, prepare a bucket with your code. Create an AWS Identity and Access Management (IAM) role that grants AWS Continuum access to the bucket. Then connect an Amazon S3 integration and create an environment that uses it.

In the following example, replace amzn-s3-demo-bucket with your bucket name. Replace my-app.zip with your package file name.

The example source URI is s3://amzn-s3-demo-bucket/code/my-app.zip. Its object key is code/my-app.zip. The corresponding Source code base path value is code/.

To prepare an Amazon S3 source, do the following:

Create an Amazon S3 bucket in the same account and AWS Region where you enable AWS Continuum.
Choose a prefix in the bucket for your source code, such as code/. You configure this prefix when creating the environment.
Upload your code under the chosen prefix as a .zip package. For instructions on uploading objects, see Uploading objects in the Amazon S3 User Guide.
In the Amazon S3 console, on Upload: status, confirm that the upload succeeded. If the upload fails, resolve the error before continuing.

Granting access to the bucket

As an administrator, create an IAM role in the same account as the bucket. The role path must be /continuum/integrations/. The role needs a permissions policy for the bucket and a trust policy so that AWS Continuum can assume the role.

In addition to the read permissions for the console, the IAM principal that creates the integration must have the following permissions:

continuum:CreateIntegration to create the integration
iam:ListRoles to select the integration role
s3:ListAllMyBuckets to browse Amazon S3 buckets
iam:PassRole to pass the integration role

Restrict iam:PassRole to the integration role. Use the iam:PassedToService condition key with the value continuum.amazonaws.com.

For information about permissions required to create an integration in the console, see Using the AWS Continuum console.

Save the following JSON permissions policy as integration-permissions.json. Use it to let AWS Continuum list the bucket and read source objects and versions under your code and context prefixes. It also grants AWS Continuum permission to upload and read patches under continuum-patches/.

Grant s3:ListBucket without a condition. AWS Continuum uses this permission to validate access to the bucket when you create the integration.

Use each configured prefix exactly, including any trailing slash. If you omit these values, the defaults are code/ and context/, respectively. Your source files can be stored under other prefixes, but the policy must grant access to those prefixes.

Replace bucket-name with the bucket used by your integration. Replace code-prefix with the Source code base path value. Replace context-prefix with the Knowledge documents base path value.


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListSourceBucket",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::bucket-name"
    },
    {
      "Sid": "ReadSourcePrefixes",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion"
      ],
      "Resource": [
        "arn:aws:s3:::bucket-name/code-prefix*",
        "arn:aws:s3:::bucket-name/context-prefix*"
      ]
    },
    {
      "Sid": "DeliverContinuumPatches",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:GetObjectVersion"
      ],
      "Resource": "arn:aws:s3:::bucket-name/continuum-patches/*"
    }
  ]
}

Use the following trust policy so that the AWS Continuum service principal, continuum.amazonaws.com, can assume the role with an external ID. Replace external-id with the external ID that you enter when creating the integration. Save the policy as trust-policy.json.


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ContinuumAccess",
      "Effect": "Allow",
      "Principal": {
        "Service": "continuum.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "external-id"
        }
      }
    }
  ]
}

To create the role, configure the AWS CLI with a customer administrator principal that can create the role and attach an inline policy. Save both policy files in the current directory.

If a command fails, resolve the error before continuing. If create-role returns EntityAlreadyExists, choose an unused role name and use it consistently in these commands.

To create the integration role (AWS CLI)

Create the role with the required path.


aws iam create-role \
    --role-name ContinuumIntegrationRole \
    --path /continuum/integrations/ \
    --assume-role-policy-document file://trust-policy.json

The command returns details of the new role.

Attach the bucket permissions as an inline policy.


aws iam put-role-policy \
    --role-name ContinuumIntegrationRole \
    --policy-name ContinuumIntegrationAccess \
    --policy-document file://integration-permissions.json

This command produces no output on success.

Verify that the role's Amazon Resource Name (ARN) includes role/continuum/integrations/.
```
aws iam get-role \
    --role-name ContinuumIntegrationRole \
    --query 'Role.Arn' \
    --output text
```
The output has the following format, where account-id is your AWS account ID and role-name is the role name that you used in the commands:
```
arn:aws:iam::account-id:role/continuum/integrations/role-name
```

If a command returns an access denied error, ask your administrator to check your permissions. These commands require iam:CreateRole, iam:PutRolePolicy, and iam:GetRole, respectively.

For information about diagnosing policies that deny access, see Troubleshoot access denied error messages in the IAM User Guide.

Changes to IAM roles and policies can take time to become available. Before you use the role to create the integration, allow time for the changes to propagate. For more information, see Changes that I make are not always immediately visible in the IAM User Guide.

Keep the role and its policies while an integration uses them. When you no longer need an integration, first update or delete every environment that references it, and then delete the integration. After deleting every integration that uses the role, delete the role and its policies if no other workload uses them. For information about deleting roles, see Delete roles or instance profiles in the IAM User Guide.

For more information about external IDs, see Access to AWS accounts owned by third parties in the IAM User Guide.

Connecting an S3 integration

After you prepare the bucket and IAM role, create an Amazon S3 integration. The integration connects the bucket and role so that an environment can access your code.

Open the AWS Continuum console at https://console.aws.amazon.com/continuum/.
Under Code vulnerabilities, choose Integrations.
Choose Add integration.
For Source provider, select Amazon S3.
For Name, enter an integration name.
For S3 bucket, use one of the following options:
- To select a bucket, choose Browse S3. Select your bucket.
- To enter an ARN, choose Enter bucket ARN manually. For Bucket ARN, enter the bucket ARN.

To grant access and create the integration, continue in the same form:

For IAM role ARN, select the role that you created.
For External ID, enter the value required by the role's sts:ExternalId condition. The integration value must match the trust policy value.
Choose Create integration.

After you create the integration, the console opens Create environment. Continue to Creating an environment.

If access validation fails, check the required role path. Verify the integration role trust policy and matching external ID. Check that the role's permissions allow access to the bucket and prefixes that you use.

Creating an environment

An environment defines the code sources, scan frequency, and patch delivery settings that AWS Continuum uses to scan your code.

After you create a GitHub or Amazon S3 integration, the console opens Create environment.

If you already have an integration, use these steps to open Create environment:

Open the AWS Continuum console at https://console.aws.amazon.com/continuum/.
In the navigation pane, choose Environments.
Choose Create environment.

Keep Automatically deliver remediation patches selected to deliver patches to your code source. AWS Continuum uploads patches to your Amazon S3 bucket or opens pull requests in your GitHub repositories.

To configure the environment, continue in the same form:

For Environment name, enter a name.
In Code sources, for Integration, select the integration that you want to use.
Configure the code source:
1. If you selected a GitHub integration, for Repositories, enter the repositories that you want to scan. Enter each repository as owner/repository.
2. If you selected an Amazon S3 integration, for Source code base path, enter the prefix where you uploaded your code. The default is code/.
3. If you selected an Amazon S3 integration and uploaded custom context, enter its prefix in Knowledge documents base path. The default is context/.

To set the scan frequency and create the environment, continue in the same form:

Expand Scan schedule.
In Scan schedule, for Scan frequency, select one of the following options:
- Every day
- Every 2 days
- Every 7 days
- Manual only
(Optional) To change patch delivery or allowed dependency domains, expand Advanced.
(Optional) Under Advanced, select or clear Automatically deliver remediation patches.
(Optional) Under Advanced, for Allowed dependency domains, enter additional domains needed to build your code.
Choose Create environment.

Following the first scan

After you create the environment, the console opens Environments. Creating the environment starts the first build and scan. The selected scan frequency applies to subsequent scans.

To follow the first scan, do the following:

On the Environments page, find the Created environment-name notification. Choose View environment details.
Choose the Scans tab.
On the Scans tab, choose the refresh icon (Refresh scans) to update the results.
Review the Status column for the first scan. Refresh the results to check for updates.

When a scan completes successfully, its Status changes to Succeeded. AWS Continuum may continue processing findings into issues and generating patches after the scan completes.

To follow this processing, choose the Findings or Issues tab and refresh the results. Open an issue to review its processing status and any available patches.

To stop automatic scans, set Scan frequency to Manual only. For instructions on changing the scan frequency, see Triggering a scan.

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Code vulnerabilities

Adding context